CVE-2026-27459 json
pyOpenSSL DTLS cookie callback buffer overflow
published 2026-03-16 7 mo ago modified 2026-09-11 59 d ago also EUVD-2026-12677 , GHSA-5pwr-322w-8jr4 , PYSEC-2026-2269
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values that are too long are now rejected.
Patch / fix
- pypi pyopenssl 26.0.0
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:26.0.0-1.el8ap
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:26.0.0-1.el9ap
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:4.7.11-2.el9ap, 0:26.0.0-1.el9ap
- Red Hat Red Hat Satellite 6.16 for RHEL 8 0:24.1.0-2.el8pc
- Red Hat Red Hat Satellite 6.16 for RHEL 9 0:24.1.0-2.el9pc
- Red Hat Red Hat Satellite 6.17 for RHEL 9 0:25.1.0-0.3.el9pc
- Red Hat Red Hat Satellite 6.18 for RHEL 9 0:26.0.0-2.el9pc
- Red Hat RHUI 4 for RHEL 8 0:24.1.0-2.el8ui
- Red Hat Red Hat Ansible Automation Platform 2.5 1777398315, 1777403872
- Red Hat Red Hat Ansible Automation Platform 2.6 1777296732, 1777299023, 1777387242, 1777390240, 1777390333, 1777391447
- Red Hat Red Hat Ansible Automation Platform 2.7 1787217531, 1787235693
- Red Hat Red Hat Hardened Images 2.20.0-0.8.hum1, 26.0.0-1.1.hum1
- Red Hat Red Hat Quay 3.10 1776736910
- Red Hat Red Hat Quay 3.12 1776752646
- Red Hat Red Hat Quay 3.14 1779689392
- Red Hat Red Hat Quay 3.15 1780891395
- Red Hat Red Hat Quay 3.16 1779204086
- Red Hat Red Hat Quay 3.17 1779922205
- Red Hat Red Hat Quay 3.18 1784987273
- Red Hat Red Hat Quay 3.9 1776782369
- Red Hat Red Hat Trusted Artifact Signer 1.4 1775815407
- pyopenssl Debian 13 25.0.0-1+deb13u1
- pyopenssl Debian 14 26.0.0-1
debian advisories DEBIAN-CVE-2026-27459
- pyopenssl Ubuntu 24.04 LTS 23.2.0-1ubuntu0.1
- pyopenssl Ubuntu 25.10 25.0.0-1ubuntu0.1
ubuntu advisories UBUNTU-CVE-2026-27459
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- jaeger hummingbird 1 2.20.0-0.8.hum1
- candlepin satellite 6.16 4.4.25-1.el8sat
- candlepin satellite 6.17, satellite 6.16 4.4.25-1.el9sat
- python-pillow satellite capsule 6.16, satellite 6.16 12.1.1-1.el8pc
- python-pillow satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 12.1.1-1.el9pc
- python-markdown satellite capsule 6.16, satellite 6.16 3.8.2-1.el8pc
- python-markdown satellite capsule 6.17, satellite capsule 6.16, satellite 6.17 +1 more 3.8.2-1.el9pc
- python-pyOpenSSL satellite capsule 6.16, satellite 6.16 24.1.0-2.el8pc
red hat advisories RHSA-2026:48758RHSA-2026:14874RHSA-2026:14873RHSA-2026:14835RHSA-2026:13508RHSA-2026:13512
- grafana Multi Linux Manager Tools SLE-15 12.4.10-150002.4.27.1
- mgr-push Multi Linux Manager Tools SLE-15 5.2.5-150002.3.12.1
- spacecmd Multi Linux Manager Tools SLE-15 5.2.10-150002.3.15.1
- uyuni-tools Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 5.2.17-150002.3.20.1
- venv-salt-minion Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 3006.0-150002.5.22.1
- spacewalk-client-tools Multi Linux Manager Tools SLE-15 5.2.7-150002.3.12.1
- golang-github-prometheus-prometheus Multi Linux Manager Tools SLE-15 3.13.2-150002.3.19.1
- mgr-push Multi Linux Manager Tools SLE-12 5.2.5-120002.3.12.1
suse advisories SUSE-SU-2026:4585-1SUSE-SU-2026:4584-1SUSE-SU-2026:4583-1SUSE-SU-2026:4582-1SUSE-SU-2026:4581-1SUSE-SU-2026:4580-1
- python-pyOpenSSL openSUSE Leap 16.0 25.0.0-160000.3.1
- python-pyOpenSSL openSUSE Tumbleweed 26.0.0-1.1
opensuse advisories openSUSE-SU-2026:20419-1openSUSE-SU-2026:10392-1
- py3-openssl Alpine 3.24, Alpine 3.23 26.1.0-r0
alpine advisories ALPINE-CVE-2026-27459
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-27459 updated cvss 8.1
pyOpenSSL: DTLS cookie callback buffer overflow
-
Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9affected: workaround, no fix available “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.”
-
Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-27/hub-rhel9, ansible-automation-platform-24/controller-rhel8, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-26/controller-rhel9, ansible-automation-platform-26/ee-minimal-rhel9affected: workaround, no fix available, no fix planned “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.”
-
Red Hat Ansible Automation Platform Ansible Core 2 ansible-automation-platform/ee-minimal-rhel8, ansible-automation-platform/ee-minimal-rhel9, ansible-automation-platform-tech-preview/ee-minimal-rhel8, ansible-automation-platform-tech-preview/ee-minimal-rhel9 Red Hat Ceph Storage 7 rhceph/rhceph-7-rhel9 Red Hat Ceph Storage 8 rhceph/rhceph-8-rhel9 Red Hat Ceph Storage 9 rhceph/rhceph-9-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-feature-server-rhel9affected: workaround, no fix available “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.”
-
Red Hat Update Infrastructure 4 for Cloud Providers python-redis, python-urllib3affected: workaround, no fix planned “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.”
-
Red Hat Update Infrastructure 5 rhui5/cds-rhel9, rhui5/rhua-rhel9, rhui5/cds-kubernetes-rhel9affected: workaround, no fix available “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.”
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25 1777398315, ansible-automation-platform-25 1777403872fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:13553
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 python3.12-pyOpenSSL 26.0.0-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 python3.12-pyOpenSSL 26.0.0-1.el9apfixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:13512
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26 1777296732, ansible-automation-platform-26 1777299023, ansible-automation-platform-26 1777387242, ansible-automation-platform-26 1777390240, ansible-automation-platform-26 1777390333, ansible-automation-platform-26/ee-supported-rhel9 1791974220fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:13545
show 18 moreshow fewer
-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 python3.12-pyOpenSSL 26.0.0-1.el9ap, automation-controller 4.7.11-2.el9ap, automation-controller-ui 4.7.11-2.el9ap, automation-controller-cli 4.7.11-2.el9ap, automation-controller-server 4.7.11-2.el9ap, automation-controller-venv-tower 4.7.11-2.el9apfixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:13508
-
Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/lightspeed-rhel9 1787217531, ansible-automation-platform-27/ee-supported-rhel9 1792396518fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:87124
-
Red Hat Hardened Images jaeger 2.20.0-0.8.hum1, pyOpenSSL 26.0.0-1.1.hum1, python3-pyOpenSSL 26.0.0-1.1.hum1fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:48758
-
Red Hat Quay 3.9 quay 1776782369fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:11996
-
Red Hat Quay 3.10 quay 1776736910fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:11916
-
Red Hat Quay 3.12 quay 1776752646fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:11856
-
Red Hat Quay 3.14 quay/quay-rhel8 1779689392fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:21017
-
Red Hat Quay 3.15 quay/quay-rhel8 1780891395fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:24853
-
Red Hat Quay 3.16 quay 1779204086fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:19375
-
Red Hat Quay 3.17 quay/quay-rhel9 1779922205fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:22465
-
Red Hat Quay 3.18 quay/quay-rhel9 1784987273fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:48085
-
Red Hat Satellite 6.16 for RHEL 8 python-pyOpenSSL 24.1.0-2.el8pc, python3.11-pyOpenSSL 24.1.0-2.el8pc Red Hat Satellite 6.16 for RHEL 9 python-pyOpenSSL 24.1.0-2.el9pc, python3.11-pyOpenSSL 24.1.0-2.el9pcfixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:14874
-
Red Hat Satellite 6.17 for RHEL 9 python-pyOpenSSL 25.1.0-0.3.el9pc, python3.11-pyOpenSSL 25.1.0-0.3.el9pcfixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:14873
-
Red Hat Satellite 6.18 for RHEL 9 python3.12-pyOpenSSL 26.0.0-2.el9pcfixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:14835
-
Red Hat Satellite 6.19 satellite/iop-vmaas-rhel9 1789611998fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:68780
-
Red Hat Trusted Artifact Signer 1.4 rhtas 1775815407fixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:8437
-
Red Hat RHUI 4 for RHEL 8 python-pyOpenSSL 24.1.0-2.el8ui, python3.11-pyOpenSSL 24.1.0-2.el8uifixed: vendor fix “To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.” RHSA-2026:10754
-
Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-podvm-builder-rhel9 Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat Ansible Automation Platform 2 python-pyOpenSSL, python3x-pyOpenSSL, python3.11-pyOpenSSL, ansible-automation-platform-25/hub-rhel8, ansible-automation-platform-24/ee-minimal-rhel8, ansible-automation-platform-24/ee-minimal-rhel9, +12 more Red Hat Ansible Automation Platform 2.5 ansible-automation-platform 1777407814, ansible-automation-platform 1777407821, ansible-automation-platform-25 1777191649, ansible-automation-platform-25 1777191659, ansible-automation-platform-25 1777191672, ansible-automation-platform-25 1777191685, +19 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.4-2.el8ap, yamllint 1.38.0-1.el8ap, receptorctl 1.6.4-2.el8ap, ansible-lint 26.1.1-1.el8ap, ansible-core 2.16.18-1.el8ap, ansible-test 2.16.18-1.el8ap, +43 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.4-2.el9ap, yamllint 1.38.0-1.el9ap, receptorctl 1.6.4-2.el9ap, ansible-lint 26.1.1-1.el9ap, ansible-core 2.16.18-1.el9ap, ansible-test 2.16.18-1.el9ap, +43 morenot affected: vulnerable code not present
+3 more productsfewer
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform 1777410604, ansible-automation-platform 1777410621, ansible-automation-platform-26 1777163004, ansible-automation-platform-26 1777163348, ansible-automation-platform-26 1777163557, ansible-automation-platform-26 1777163594, +49 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.4-2.el9ap, yamllint 1.38.0-1.el9ap, receptorctl 1.6.4-2.el9ap, ansible-lint 26.1.1-1.el9ap, ansible-core 2.16.18-1.el9ap, ansible-test 2.16.18-1.el9ap, +41 more Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor 1.6.4-3.el10ap, yamllint 1.38.0-2.el10ap, receptorctl 1.6.4-3.el10ap, ansible-lint 26.1.1-2.el10ap, python-black 26.3.1-2.el10ap, ansible-core 2.16.18-2.el10ap, +7 more
23 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
| CISA ADP | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 7.2 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pyopenssl | >=22.0.0, <26.0.0 |
26.0.0 |
Affected products
- pyca pyopenssl
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Red Hat Satellite 6.16 for RHEL 8
- Red Hat Red Hat Satellite 6.16 for RHEL 9
- Red Hat Red Hat Satellite 6.17 for RHEL 9
- Red Hat Red Hat Satellite 6.18 for RHEL 9
- Red Hat RHUI 4 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5
- Red Hat Red Hat Ansible Automation Platform 2.6
- Red Hat Red Hat Ansible Automation Platform 2.7
- Red Hat Red Hat Hardened Images
- Red Hat Red Hat Quay 3.10
- Red Hat Red Hat Quay 3.12
- Red Hat Red Hat Quay 3.14
- Red Hat Red Hat Quay 3.15
- Red Hat Red Hat Quay 3.16
- Red Hat Red Hat Quay 3.17
- Red Hat Red Hat Quay 3.18
- Red Hat Red Hat Quay 3.9
- Red Hat Red Hat Trusted Artifact Signer 1.4
- Red Hat Confidential Compute Attestation
- Red Hat Exploit Intelligence
- Red Hat Lightspeed Core
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Ansible Automation Platform Ansible Core 2
- Red Hat Red Hat Ceph Storage 7
- Red Hat Red Hat Ceph Storage 8
- Red Hat Red Hat Ceph Storage 9
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat OpenShift AI (RHOAI)
- Red Hat Red Hat OpenShift Container Platform 4
- Red Hat Red Hat OpenStack Platform 17.1
- Red Hat Red Hat OpenStack Platform 18.0
- Red Hat Red Hat Satellite 6
- Red Hat Red Hat Update Infrastructure 4 for Cloud Providers
- Red Hat Red Hat Update Infrastructure 5
Classification
- Weakness
-
- CWE-120 Buffer Copy without Checking Size of Input
References
-
github.com
/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408
web, patch
-
access.redhat.com
/errata/RHSA-2026:13512
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:10754
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:14874
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:13508
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:14873
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:14835
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:13553
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:13545
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:59153
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:48758
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:7224
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:11916
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:11856
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:21017
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:24853
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:19375
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:22465
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:48085
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:11996
vendor-advisory, advisory
-
access.redhat.com
/errata/RHSA-2026:8437
vendor-advisory, advisory
-
github.com
/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4
web, vendor-advisory, advisory
-
github.com
/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst
web, release-notes, advisory
-
access.redhat.com
/security/cve/CVE-2026-27459
vdb-entry, web
-
bugzilla.redhat.com
/show_bug.cgi?id=2448503
issue-tracking, report
-
security.access.redhat.com
/data/csaf/v2/vex/2026/cve-2026-27459.json
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-27459
advisory
-
github.com
/pyca/pyopenssl
package
Sources
- CVE List CVE-2026-27459
- GitHub Advisory GHSA-5pwr-322w-8jr4
- NVD CVE-2026-27459
- OSV PYSEC-2026-2269
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.